使用数字证书自动启用宏？
那么，由受信任的签名机构颁发的数字证书在用于签署 Excel 文档时是否允许该文档自动运行宏呢？
签名是自签名还是由证书颁发机构签名对于用户看到的内容有区别吗？
与您在网页上使用威瑞信颁发的证书类似，计算机通常会自动信任该机构颁发的证书。我想知道 Excel 中的行为是否类似。
我基本上试图解决分发 Excel 表单的问题，这些表单依赖于宏才能正常运行。
So will a digital certificate that is issued from a trusted signing authority, when used to sign an Excel document, allow the document to automatically run macros?
Does it make a difference whether the signature is self signed or signed by a certificate authority in terms of what the user sees?
Similar to when you use a verisign issued certificate on a webpage, the machine usually autmatically trusted certificates issued by that authority. I am wondering if the behavior in Excel is similar.
I am basically trying to address the issue of distributing Excel forms which are dependent upon a macro to function properly.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您从（例如 VeriSign）购买签名密钥，则可以使用它来签署您的宏代码。当用户打开包含您签名的代码的文件时，会发生什么取决于他们设置的“宏安全级别”。让我们假设它处于最高级别，这将默默地阻止任何未签名的代码运行。
在这种情况下，他们将被告知他们的文件是由（您的公司名称）签署的，并询问他们是否希望运行它。他们每次打开文件时都会被问到这个问题。但是，还有一个标题为“始终信任来自该发布者的宏”的复选框 - 如果他们勾选该复选框，那么您公司的任何签名代码将在没有进一步提示的情况下运行。
注意：您从 VeriSign 购买的签名有一个到期日 - 通常在一两年后。除非您在签署代码之前采取一些额外的步骤，否则证书过期后代码将不再运行(!)。当您的用户一年后突然发现没有任何效果时，这可能会导致严重的震惊。
为了确保代码即使在证书过期后也能继续工作，您需要在注册表中添加一些值，指定将用于为签名代码添加时间戳的“时间戳服务器”。此时间戳稍后用于验证代码是否使用签名时有效的证书进行签名，而不是现在有效的证书。
有关如何执行此操作的信息，请参阅此链接。
If you buy a signing key from (e.g. VeriSign), then you can use this to sign your macro code. When a user opens a file containing your signed code, what happens then depends on the "macro security level" they have set. Let's assume it's at the highest level, which would silently prevent any un-signed code from running.
In this case, they will be told that they file is signed by (your company name) and asked if they wish to run it. They'll be asked this every time they open the file. However, there's also a check-box titled "always trust macros from this publisher" - if they tick that, then any signed code from your company will thereafter be run with no further prompting.
Note: the signature you buy from VeriSign has an expiry date - usually after a year or two. Unless you take some extra steps before signing your code, then the code will no longer run after the certificate expires(!). This can lead to a nasty shock when your users suddenly find that nothing works a year later.
To ensure that the code continues to work even after the certificate has expired, you need to add some values in the registry that specify a "time-stamp server" that will be used to time-stamp the signed code. This time-stamp is later used to validate that the code was signed with a certificate that was valid at the time of signing, as opposed to one that is valid now.
For information on how to do this, see this link.